-= Per source details. Do not edit below this line.=-
On import, the package's top-level init.py starts a background daemon thread that spawns xmrig via subprocess.Popen against pool.minexmr.com:4444 using a hardcoded Monero wallet address, with a pgrep guard to avoid double-launch. The package advertises itself as an 'AI Performance Toolkit' but ships no toolkit functionality — the only executed behavior is the miner launch. Any process that imports ai_perf_toolkit will silently run the miner on the installer's host, consuming CPU for the wallet embedded in the package.
During import, the package starts cryptomining for a hardcoded wallet. The mining software has to already be installed.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-07-ai-perf-toolkit
Reasons (based on the campaign):
2.4.2Exploitability
AV:NAC:LPR:NUI:NScope
S:CImpact
C:HI:HA:H10.0/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H